What authentication method does Etherscan's API use?

Etherscan's Developer APIs primarily use API keys for authentication. These keys are unique alphanumeric strings generated from your Etherscan account dashboard.

Do I need an API key for all Etherscan API requests?

While some basic public endpoints might be accessible without a key, most programmatic access, especially for higher rate limits and consistent usage, requires an API key to track usage and manage quotas.

How do I get an Etherscan API key?

You need to create an Etherscan account, log in, and then navigate to the 'API Keys' section in your account dashboard to generate a new key.

Where do I include the API key in my requests?

The API key is typically included as a query parameter named 'apikey' in the URL of your API request, for example: `https://api.etherscan.io/api?...&apikey=YOUR_API_KEY`.

What are the security best practices for Etherscan API keys?

Key security best practices include never hardcoding keys, using environment variables, implementing IP whitelisting, regularly rotating keys, monitoring usage, and ensuring keys are never exposed in client-side code.

Can I have multiple API keys for different applications?

Yes, Etherscan allows you to generate multiple API keys from your account dashboard, which can be named to help you manage and track usage for different projects or applications.

What happens if my Etherscan API key is compromised?

If your API key is compromised, it could lead to unauthorized usage, potentially consuming your rate limits or incurring costs if you are on a paid plan. You should immediately revoke the compromised key from your Etherscan account dashboard and generate a new one.

Etherscan Authentication: API Key Setup & Security (2026)

Authentication overview

Etherscan provides a public API for developers to programmatically access Ethereum blockchain data. While some basic web interface functionality and public API endpoints can be accessed without explicit authentication, most programmatic use cases, particularly those requiring higher query limits or specific features, rely on API key authentication. An API key serves as a unique identifier for your application, allowing Etherscan to manage request quotas, track usage, and provide access to features associated with your account tier.

The Etherscan API key mechanism functions as a form of token-based authentication, where the key itself acts as a credential. Unlike more complex schemes like OAuth 2.0, which involve multiple steps for token issuance and refresh, Etherscan's approach is simpler, requiring the direct inclusion of the API key in each request. This method is common for service-to-service communication where a client application directly authenticates itself to the API provider.

Proper management of API keys is crucial for maintaining the security and integrity of your applications and data. Unauthorized access to your API key could lead to misuse of your Etherscan account, potentially impacting your rate limits or exposing sensitive information if your application handles it.

Supported authentication methods

Etherscan primarily supports one method for authenticating API requests: the API key. This method is standard across all its developer APIs, including those for querying transactions, block data, account balances, and contract information. There are no other widely advertised authentication mechanisms like OAuth 2.0 or JWTs for direct API access as of 2026. However, Etherscan's web interface supports traditional username/password login for account management.

The API key is typically passed as a query parameter in the API request URL. Each API key is associated with an Etherscan account and can be managed through the user dashboard.

API Key

An API key is a unique alphanumeric string generated within your Etherscan account. It identifies the calling application or user and grants access to specific API endpoints and tiers. API keys manage rate limits and feature access, with different tiers (e.g., Free, Pro, Business) offering varying request capacities and functionalities, as detailed on the Etherscan API plans page.

Method	When to Use	Security Level
API Key	Programmatic access to Etherscan Developer APIs requiring rate limit management and usage tracking.	Medium (Requires careful handling to prevent unauthorized access and misuse. Equivalent to a password if exposed.)

Getting your credentials

To obtain an Etherscan API key, you must have an Etherscan account. The process involves registering on their website and then navigating to the API management section of your account dashboard. Follow these steps:

Create an Etherscan Account: If you don't already have one, visit the Etherscan registration page and sign up. You will need to provide an email address and set a password.
Log In: After successful registration and email verification, log in to your Etherscan account.
Access API Keys Section: Navigate to your user dashboard. Look for a section or menu item labeled "API Keys" or "My API Key". This is typically found under your profile or account settings. A direct link to this section is often available after logging in on the Etherscan APIs page.
Generate New API Key: On the API Keys page, you will usually find an option to "Add" or "Generate New API Key". Click this button. You might be prompted to give your key a name for easier identification, especially if you plan to create multiple keys for different applications.
Copy Your API Key: Once generated, your API key will be displayed. It's a long alphanumeric string. Copy this key immediately, as it may not be fully displayed again for security reasons. Treat it like a password.
Configure Security (Optional but Recommended): Some API key management interfaces allow you to configure additional security settings, such as IP address whitelisting. If this option is available, consider restricting API key usage to specific IP addresses from which your application will make requests. This adds an extra layer of security, preventing unauthorized use even if your key is compromised.

Once you have your API key, you can use it in your API requests to Etherscan. Remember that your API key is directly tied to your account's rate limits and plan features.

Authenticated request example

Etherscan API requests typically include the API key as a query parameter named apikey. The base URL for the Etherscan API is api.etherscan.io. This example demonstrates how to fetch the Ether balance for a specific address using curl, a common command-line tool for making HTTP requests.

Before executing the example, replace YOUR_API_KEY with your actual Etherscan API key and 0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae with the desired Ethereum address.

curl "https://api.etherscan.io/api?
  module=account&
  action=balance&
  address=0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae&
  tag=latest&
  apikey=YOUR_API_KEY"

In this example:

module=account specifies the API module to use.
action=balance indicates the specific action within the module (getting an account's balance).
address=0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae is the Ethereum address for which to retrieve the balance.
tag=latest specifies to get the balance at the latest block.
apikey=YOUR_API_KEY is where you insert your Etherscan API key.

Upon successful execution, the API will return a JSON response containing the Ether balance in Wei (the smallest denomination of Ether), along with a status and message. For more detailed API endpoint documentation, refer to the Etherscan API documentation.

Security best practices

Securing your Etherscan API keys is essential to prevent misuse, unauthorized access, and potential disruption to your application's functionality. Adhering to these best practices helps protect your credentials and maintain the integrity of your API interactions:

Never Hardcode API Keys: Avoid embedding API keys directly within your application's source code. Hardcoded keys can be exposed if your code repository is compromised or during deployment. Instead, use environment variables, configuration files, or secret management services.
Use Environment Variables: For server-side applications, store your API key as an environment variable. This keeps the key separate from your codebase and outside of version control. For example, in Node.js, you might access it via process.env.ETHERSCAN_API_KEY.
Implement IP Whitelisting: If Etherscan's API key management interface allows it, restrict API key usage to a specific set of IP addresses. This ensures that even if your key is compromised, it can only be used from trusted servers or locations. This is a common security feature for API keys, as described in guides like the Cloudflare API security considerations.
Limit Key Permissions (if applicable): While Etherscan's API keys generally provide access to all public API endpoints under your account's rate limits, if you have options to create keys with more granular permissions in the future, always apply the principle of least privilege. Grant only the necessary access for each key.
Regularly Rotate API Keys: Periodically generate new API keys and revoke old ones. This practice reduces the window of opportunity for a compromised key to be exploited. A rotation schedule, such as every 90 days, can enhance security.
Monitor Usage and Logs: Regularly check your Etherscan account for API usage statistics and any available logs. Unusual spikes in requests or unexpected API calls could indicate a compromised key.
Encrypt Keys at Rest: If you must store API keys in configuration files, ensure these files are encrypted, especially on production servers. Use robust encryption mechanisms to protect them from unauthorized access.
Never Expose Keys in Client-Side Code: For web applications, never embed API keys directly in client-side JavaScript or other publicly accessible code. If your application needs to make API calls from the client, route them through your own secure backend server, which can then add the API key before forwarding the request to Etherscan.
Secure Your Development Environment: Ensure that your local development environment and CI/CD pipelines are secure. Misconfigured environments can inadvertently expose API keys through logs, environment dumps, or insecure configuration files.
Use HTTPS/TLS: Always ensure that all communications with the Etherscan API use HTTPS. This encrypts the data in transit, including your API key, protecting it from eavesdropping. All Etherscan API endpoints are served over HTTPS by default, which is a standard for secure web communication, as defined by organizations like the W3C on web security.